Search for how to wipe a laptop and you will find step-by-step instructions for resetting Windows or erasing a Mac. For one personal device, that is usually enough. For an organisation retiring dozens or hundreds of laptops a year, the steps themselves are the easy part; the harder question is whether you can show, device by device, that the data is gone.
That evidence is what separates a factory reset from secure data erasure. This guide covers what built-in reset tools actually do, what changes when the drive is an SSD, and how IT teams can wipe laptops in a way that satisfies privacy obligations, auditors and the next owner of the device.
What a Factory Reset Does, and Where It Stops
Both major operating systems include a reset option. Windows offers Reset this PC, with a setting to clean the drive when removing everything. On Mac computers with Apple silicon or the Apple T2 Security Chip, Apple's Erase All Content and Settings removes all settings, data and apps while keeping the operating system installed.
These tools are well built, and on modern hardware they do a good job of making data inaccessible. For a business, the gaps lie elsewhere:
- No independent record: a reset does not produce a certificate linking a serial number to an erasure method, a date and a result.
- No verification: nobody confirms that the process completed successfully on every device.
- Human variability: when technicians reset devices by hand, settings get missed and devices get skipped, especially in a busy week.
- Management ties remain: a reset does not remove a device from Apple Business, Windows Autopilot or your MDM platform, which affects whether anyone else can use it.
A factory reset suits a device that is staying inside the business and moving to a new user. A device leaving the business needs an erasure you can prove.
Why SSDs Changed the Way Laptops Are Wiped
Older advice on how to wipe a hard drive centred on overwriting data several times. That approach was designed for spinning disks. Modern laptops use solid state drives, which store and relocate data differently, so repeated overwriting cannot reliably reach every storage cell.
Current guidance reflects this. NIST published SP 800-88 Revision 2 in September 2025, updating its media sanitisation guidelines and expanding its guidance on cryptographic erase. For flash storage, the dependable approach is to use the drive's built-in sanitise or cryptographic erase functions, applied by software that confirms the command completed. Australian government agencies and many regulated businesses also follow the Australian Signals Directorate's ISM guidelines for media, which set out requirements for sanitisation and destruction.
For IT teams, the takeaway is that wiping an SSD properly depends on the right tool and a verified result rather than the number of passes.
What Privacy Law Expects When Laptops Leave the Business
Under the Privacy Act, Australian Privacy Principle 11 requires organisations to take reasonable steps to destroy or de-identify personal information once it is no longer needed. The OAIC's guidance says this includes sanitising hardware to remove stored personal information before disposal.
Reasonable steps are judged on the circumstances, and an auditor or regulator will want to see records. A documented erasure standard, a per-device certificate and a clear chain of custody are the simplest way to show those steps were taken. For organisations certified to ISO/IEC 27001, the same records support the control covering secure disposal or re-use of equipment.
Before You Wipe: Three Steps IT Teams Often Miss
Most problems with retired laptops start before the erase begins.
- Remove management enrolments. Microsoft advises that a device should always be deregistered from Windows Autopilot when it permanently leaves an organisation; otherwise it can still be claimed by your tenant when the next owner sets it up.
- Clear Apple locks. Macs, iPhones and iPads can be tied to a user's Apple Account or your organisation's management service, and our guide to Activation Lock and MDM lock covers how to release them.
- Check retention requirements. Confirm that any data on the device that must be kept has been backed up or archived in line with your records policy.
How to Wipe a Laptop for Business: A Repeatable Process
A process your team can repeat for every device looks like this:
- Record the asset. Capture the serial number, asset tag and assigned user in your asset register.
- Confirm retention. Make sure any required data has been preserved.
- Remove management ties. Deregister the device from Autopilot and your MDM, and clear Activation Lock.
- Erase with verified software. Use a tool that applies the correct method for the drive type and confirms the result.
- Issue a certificate. Generate a per-device certificate showing the method, standard, date and outcome.
- Decide the next step. Redeploy, resell or recycle, based on the device's condition and age.
- File the evidence. Store the certificate against the asset record so it is ready for audit.
Where a drive has failed and cannot be erased, physical destruction is the fallback, and the same record should be kept. We explain when each approach fits in data erasure vs data destruction.
Frequently Asked Questions
Does a factory reset delete everything on a laptop?
A factory reset removes user data and settings, and on modern encrypted devices it makes that data very difficult to recover. What it does not provide is a verified record that the reset happened and completed, which is the part a business needs for audit.
How do I wipe a MacBook before it leaves the business?
On Macs with Apple silicon or the T2 chip, use Erase All Content and Settings after the user has signed out of their Apple Account and turned off Find My. For organisation-owned Macs, clear Activation Lock and remove the device from your management service first, then keep a record of the erasure.
Is formatting a laptop the same as wiping it?
A quick format removes the index that points to files, but the underlying data can remain recoverable. Secure erasure applies a sanitisation method suited to the drive type and verifies the result.
What standard should business laptops be wiped to?
Most Australian organisations use NIST SP 800-88. Government agencies and their suppliers may also need to meet the Australian Signals Directorate's ISM guidelines for media.
When to Hand Laptop Wiping to a Partner
Wiping a handful of laptops in-house is manageable. At scale, the work takes technician time away from higher-value projects, and the evidence trail depends on everyone following every step every time. Writing the standard into an IT asset disposal policy helps, and many organisations go further by handing the job to a specialist as part of a wider ITAD process.
Canopy's Recover service erases working drives to NIST 800-88 standards and issues an individual certificate for each unit. As a Blancco Gold Partner, Canopy uses certified erasure software that verifies each result, then grades devices for resale so the value comes back to your business.
Get certified erasure for the devices you retire.
Use the form on this page to arrange a collection or talk to the Canopy team about your next batch of retired laptops.